FX Blue Cookie Policy
Our website uses cookies and other similar tracking technologies (“cookies”). Cookies are small text files that are placed on your computer or mobile device when you visit our website. Our website uses both session cookies and persistent cookies. Session cookies enable you to move from page to page within our website and any information you enter to be remembered. A session cookie is deleted when you close your browser or after a short time. Persistent cookies allow our website to remember your preferences and settings when you visit our website in the future. Persistent cookies expire after a set period of time.
Cookies are not the only way a website can store information on your device. Ours also uses your browser’s local storage and session storage, which the law treats in the same way as cookies, so this page lists those too. They are set out in their own section below the cookie tables.
Cookies are used in the following ways on our website:
Strictly necessary
| Cookie name | Type | Purpose | Provider | Retention |
|---|---|---|---|---|
| logged-in-user, external-authentication-token, email-address, trading-account-token, websocket-password | Persistent | Maintains your logged-in session on the Website. The same session details are also held in your browser's local storage, under the name auth in the local and session storage table below. | FX Blue (first party) | 24 hours from your last visit, and at most 30 days from signing in |
| session-hint | Persistent | Tells the pages you are viewing that you are signed in, and under which account name, so the site can show your account menu instead of a login button. It holds your account name, your email address and whether your email, phone and consent have been confirmed — the same details already held in local storage under the name auth. It holds no password and no access token. | FX Blue (first party) | 24 hours from your last visit, and at most 30 days from signing in |
| cognito-access-token | Persistent | Holds the short-lived token that proves to our servers that you are signed in. It is replaced with a fresh one roughly every hour for as long as you keep using the site. It is encrypted, and your browser cannot read it. | FX Blue (first party) | 1 hour |
| cognito-refresh-token, cognito-username, cognito-account-username | Persistent | Together these let the site get a new sign-in token for you without asking you to type your password again every hour, and tell our servers which of your accounts you are signed in as. The sign-in name is stored alongside the token because renewing needs both; the account name is stored separately because it is no longer the same once you rename your account. All three are encrypted, and your browser cannot read them. | FX Blue (first party) | 24 hours from your last visit, and at most 30 days from signing in |
| mtilive | Session | Carries your sign-in to the account widgets shown in embedded frames, so a widget shows your own data instead of asking you to sign in a second time. Set by api.fxblue.com when the widget loads, not by this page. | FX Blue (api.fxblue.com, separate host) | Deleted when you close your browser |
| MTIPin_<username> | Session | Records on the widget host that the PIN for that account has already been entered, so its widgets load rather than asking a second time. One cookie per account, named after it. It holds a short token, not the PIN. | FX Blue (api.fxblue.com, separate host) | Deleted when you close your browser |
| sessionCountry | Session | The country the widget host has worked out for you, so that what it shows matches where you are. It holds a two-letter country code and nothing else. This is the same job as the user-country cookie above, done separately by the older host. | FX Blue (api.fxblue.com, separate host) | Deleted when you close your browser |
| verified-pins-session | Session | Records that you have entered the PIN for a protected account, so you are not asked again on every page of the same visit. It stores a signed confirmation with an expiry, not the PIN itself | FX Blue (first party) | Session (at most 4 hours) |
| user-country | Persistent | Detects your country for localised content | FX Blue (first party) | 24 hours |
| CookieConsent | Persistent | Remembers your cookie preferences so we don't ask again on every visit | FX Blue (first party) | 1 year |
| FCCDCF | Persistent | Holds the state of the consent message itself: which message you were shown, and where you got to in it. Set as soon as the message is available, before and regardless of any choice you make, so that refusing is remembered as reliably as accepting. | Google LLC (third party), as consent management provider | 13 months |
| FCNEC | Persistent | Records the choices you make in the consent message, in the format advertising providers read. Written only once you have answered that message, which is the one Google shows on our behalf and not the FX Blue cookie banner, so a visitor who is never shown it never has this cookie. | Google LLC (third party), as consent management provider | 12 months |
Functional (non-essential)
| Cookie name | Type | Purpose | Provider | Retention |
|---|---|---|---|---|
| verified-pins | Persistent | Remembers the PIN you entered for a protected account across visits, so you are not asked again next time. Set only if you allow storing information on your device; without it the PIN is asked for once per visit instead. It stores a signed confirmation with an expiry date, not the PIN itself | FX Blue (first party) | 30 days |
| deviceId | Persistent | Identifies your browser to the charting, calendar and market-data widgets shown in embedded frames, so the widget provider can license them. Also stored in your browser's local storage. | FX Blue Labs (third-party frame) | 13 months |
Analytics (non-essential)
| Cookie name | Type | Purpose | Provider | Retention |
|---|---|---|---|---|
| _ga | Persistent | Distinguishes unique users for Google Analytics | Google LLC (third party) | 13 months |
| _ga_<container-id> | Persistent | Persists session state for Google Analytics 4 | Google LLC (third party) | 13 months |
| __utma, __utmz | Persistent | Classic Google Analytics, the version Google retired in 2019. This website does not use it, but the older FX Blue pages still do, and they set these on the fxblue.com domain that both share, so you will see them here too. __utma tells one browser from another and __utmz records how you first arrived; those older pages may also write the short-lived __utmb and __utmc. Because another application sets them, the choices you make on this page do not govern them. | Google LLC (third party), for the older FX Blue website | 6 months for __utmz, up to 13 months for __utma |
| _clck, _clsk | Persistent | Microsoft Clarity – measures how users interact with the Website (session recordings, heatmaps) | Microsoft Corporation (third party) | 1 day – 1 year |
Advertising (non-essential)
| Cookie name | Type | Purpose | Provider | Retention |
|---|---|---|---|---|
| MUID, CLID, ANONCHK, SM, MR, SRM_B | Mixed | Microsoft – recognises a browser across Microsoft services, and synchronises that identifier between them. Set on Microsoft's own domains rather than on ours, so you will only have them if your browser accepts third-party cookies. Safari and Firefox refuse them by default, and Chrome may too, depending on your settings. | Microsoft Corporation (third party) | Session to 13 months, depending on the name |
| __gads, __gpi | Persistent | Google Ad Manager – banner advert delivery, frequency capping and measurement | Google LLC (third party) | 13 months |
| __eoi | Persistent | Google – accompanies advert delivery and helps limit how often the same advert is shown. Unlike the two names above, this one does not wait for you to allow advertising: it is written by Google's publisher tag, which is on the page whichever way you answer, so it can turn up as you carry on browsing after a refusal. It is not set before you answer, and it is not there the moment you refuse. | Google LLC (third party) | 6 months |
| IDE | Persistent | Google – measures and limits how often the same advert is shown to you across websites. Set on Google's own advertising domain rather than on ours, so you will only have it if your browser accepts third-party cookies. Safari and Firefox refuse them by default, and Chrome may too, depending on your settings. | Google LLC (third party) | 13 months in the UK and the EEA, 24 months elsewhere |
| DSID | Persistent | Google – set on Google's own advertising domain while adverts are delivered. Google files it under security, functionality and advertising, and it is how an advertising profile is recognised across the sites where Google serves adverts. | Google LLC (third party) | 2 weeks |
| ar_debug | Persistent | Google – set on Google's own advertising domain alongside the cookies above. Google files it under analytics and advertising, and it accompanies the measurement of adverts rather than their selection. | Google LLC (third party) | 90 days |
| YSC, VISITOR_INFO1_LIVE, __Secure-YEC, __Secure-YNID, __Secure-ROLLOUT_TOKEN, LAST_RESULT_ENTRY_KEY, TESTCOOKIESENABLED, yt-icons-last-purged | Mixed | YouTube – measures viewing of embedded videos and stores user preferences. An embedded video is a still placeholder until you click it: nothing is requested from YouTube before that, and what loads then is youtube-nocookie.com, which defers these until a video actually plays. Measured on 09/09/2026: no YouTube cookie at all before the click, and none from the frame merely loading. | Google LLC / YouTube (third party) | Session – 180 days |
Local and session storage. Local storage and session storage hold information in your browser without using a cookie. Two things about them work differently from the tables above. Session storage is emptied when you close the tab, and an entry in local storage has no expiry date at all: it stays until this website deletes it or you clear your browsing data. The last column therefore says what removes each entry, rather than when it lapses.
Strictly necessary storage
| Name | Stored in | Purpose | Provider | How long it stays |
|---|---|---|---|---|
| auth | Local storage | Holds your signed-in session for the parts of the site that run in your browser: your username, email address, whether your email and phone number are verified, and the tokens the account widgets and the live price feed need. It is the same session as the sign-in cookies at the top of this page. | FX Blue (first party) | Removed when you sign out, which the site does for you once your sign-in cookies have run out — 24 hours after your last visit, and at most 30 days after signing in. Local storage entries carry no expiry date of their own. |
| registration-guid | Local storage | Ties the email verification step back to the registration you started in this browser, so that a verification link opened later finishes the right sign-up. | FX Blue (first party) | Ignored by the site 23 hours after it is written, and replaced by the next sign-up. Local storage entries carry no expiry date of their own. |
| email-change-guid | Local storage | The same thing for changing the email address on an existing account: it connects the confirmation link back to the request you made. | FX Blue (first party) | Ignored by the site 23 hours after it is written, and replaced by the next request. Local storage entries carry no expiry date of their own. |
| economic-calendar | Local storage | Remembers which panels you have shown or hidden on the economic calendar, so it opens the way you left it. It records your own choice of layout and nothing about you. | FX Blue (first party) | Stays until you change the layout again or clear your browsing data. Local storage entries carry no expiry date of their own. |
| new-release-banner | Local storage | Remembers that you have dismissed the notice about a new version of the website, so that dismissing it holds instead of the notice returning on every page. | FX Blue (first party) | Stays until you clear your browsing data. Local storage entries carry no expiry date of their own. |
| cookie-consent | Local storage | A cookie preference record from an earlier version of this website. Nothing writes it any more. It is read once, so that a decision you made before the record moved into the CookieConsent cookie is not lost, and then deleted. | FX Blue (first party) | Deleted on your first visit after this change. |
| chunk-reload, redirect_after_login, redirect_after_verify, invitation_code | Session storage | Short notes the site leaves for itself inside one tab: where to send you back to after you sign in or verify your email, an invitation code you arrived with, and a marker that lets a page reload itself once if part of it failed to download, without looping. | FX Blue (first party) | Deleted as soon as it has been used, and in any case when you close the tab. |
Non-essential storage
| Name | Stored in | Purpose | Provider | How long it stays |
|---|---|---|---|---|
| deviceId | Local storage | Functional. The same identifier as the deviceId cookie listed above, kept a second time in the storage of the widget frames themselves. Written by the frame when it loads, so it is set even though this site never asks for it. | FX Blue Labs (third-party frame) | Stays until you clear the browsing data for that frame. Local storage entries carry no expiry date of their own. |
| rc::e, rc::h | Local and session storage | Advertising. Written inside a Google reCAPTCHA frame that Google's advertising code loads to tell people apart from automated traffic. It is not attached to any form on this website. rc::h is in local storage and rc::e in session storage, and the frame appears only once you allow advertising. | Google LLC (third party) | The session storage half goes when you close the tab. The local storage half stays until you clear the browsing data for that frame. |
| viewCount, DoneInterstitial | Session storage | Advertising. The older FX Blue application counts the pages you have seen inside its own frames, so that its full-screen advert appears after a set number and is not repeated once shown. This is that site's version of the mobile-interstitial-ad entry below, and it is written by the frames rather than by this page, so the choices you make here do not govern it. | FX Blue (api.fxblue.com, separate host) | Deleted when you close the tab. |
| _cltk | Session storage | Analytics. Microsoft Clarity uses it to tie the events recorded during one visit together, so that a session is not split into unconnected pieces. Written only if you allow analytics. | Microsoft Corporation (third party) | Deleted when you close the tab. |
| mobile-interstitial-ad | Local storage | Advertising. On a phone, counts the page views where an advert could have been shown, so that a full-screen advert opens on the third one and then on every tenth. It holds that count, a marker that one has been shown, and when. Written only if you allow advertising. | FX Blue (first party) | The site starts the count again 24 hours after the last full-screen advert. The entry itself carries no expiry date and stays until you clear your browsing data. |
| _GUSM | Local storage | Advertising. Written by Google's advertising code, and only once an advert has actually been delivered to the page: allowing advertising on its own does not create it. It holds a pair of timestamps and a few flags. Google publishes no description of this item by name, so we describe here only what we have measured ourselves. It is not written at all if you refuse. | Google LLC (third party) | Stays until you clear your browsing data. Local storage entries carry no expiry date of their own. |
| _GSD | Local and session storage | Advertising. Written by Google's advertising code at the same point as _GUSM, and the only item on this page stored in two places at once. Its value is a single 1. When it is written, the page is also contacting Google's Ad Traffic Quality service, which exists to detect invalid advert traffic. Google publishes no description of this item by name either. It is not written at all if you refuse. | Google LLC (third party) | The session storage copy goes when you close the tab. The local storage copy stays until you clear your browsing data, since local storage entries carry no expiry date of their own. |
- Google Analytics – we use Google Analytics to provide us with information about how you use our website. We use this information to compile statistics and to help us to improve our website and the services we offer. Google uses cookies as part of this process to collect pseudonymous information, including the number of visitors to the website, where they have come to the website from, the pages they visit and the length of time they have spent on the website. The Google Analytics tag itself now loads on every visit, not only when you allow analytics. What your choice controls is what it may keep: refuse, and it runs with every kind of storage switched off, creates none of the cookies listed above, and the request it sends carries nothing that identifies you or your device. Allow it, and the cookies in the analytics table are the result.
- login to your account on the website – we use cookies to record that you are logged in to your account. They are written when you sign in and last 24 hours, counted from your last visit rather than from signing in: each time you come back, the 24 hours starts again. However often you visit, they are removed 30 days after you signed in, and you are asked to sign in again.
- viewing PIN-protected accounts on the website – when you enter the PIN for a protected account, we store a signed confirmation that you have entered it correctly. We never store the PIN itself. That confirmation lasts up to four hours within a single visit. It is kept for 30 days, so that you are not asked again on your next visit, only if you have allowed us to store information on your device.
The use of cookies in these ways is to improve the functionality of our website and your experience when using it. Cookies can also be disabled by changing the settings on your browser. If you do decide to disable cookies, you will be unable to log in to your account on the website, and you will be unable to view any PIN-protected accounts.
- External content – our website is partly funded by displaying banner adverts, and we may also display other third-party content such as economic calendars or educational videos. These external pages (“iframes”) may use their own cookies, including the widget frames operated by FX Blue Labs, which set the deviceId cookie listed above. We do not have access to the contents of third-party cookies set by anyone else. In effect, these banner adverts and other third-party content are external pages displayed in a frame on our Website, and the operational compliance of each third-party cookie is primarily the responsibility of the advertiser or content provider. Any such cookie is set by that provider when their frame loads, which means it is not governed by the preferences you set on this Website; to refuse it you would need to block third-party cookies in your browser.
- Advert measurement – Google Ad Manager also records whether an advert was actually visible on screen, and any clicks or errors, by sending requests to Google’s own servers. In your browser’s developer tools these appear as addresses such as pcs/view, pcs/activeview, csi and pagead/gen_204. They are requests rather than anything stored on your device, which is why they are not listed in the tables above, but they do carry whichever Google cookies your browser already holds.
Your rights and how to contact us. Information about how to contact us, your rights under UK GDPR and how to complain to the Information Commissioner’s Office is set out in our Privacy Notice.
You can learn more about cookies at www.allaboutcookies.org and www.youronlinechoices.eu.
Manage Your Settings
Your choices for this site are recorded in Google’s consent message. Open it to review them, change them, or withdraw your consent.